[For info] As CRM administrators its important to be aware that potentially sensitive business logic & operational parameters are available via unauthenticated URLs

[For info] As CRM administrators its important to be aware that potentially sensitive business logic & operational parameters are available via unauthenticated URLs

There are a collection of files within Zoho CRM that COULD contain potentially sensitive commercial parameters and logic in them, and that can be accessed without authentication.

This includes the CRM Data Model, Custom Picklist values, Custom Role / Profile names and any business settings or logic embedded in Zoho Hosted Widgets or Client Scripts.

Now... whilst these URLs are not publicly available in the first instance, anyone with legitimate access to the CRM (an employee, contractor or consultant) or access to a Client Portal version of the CRM (a member of the sales team with restricted access or a customer) can easily discover them, make a note of them and then access or share them further down the line without needing to log into the CRM.

We disclosed this finding to Zoho.

Zoho's response:

Based on the investigation, the exposed files contain only organization-specific metadata, such as module names, field definitions, API names, relationships, and picklist values.

They do not expose customer records, credentials, authentication tokens, or provide a way to compromise the CRM organization.

Therefore, no direct security impact is demonstrated. The exposure is limited to metadata and does not allow unauthorized access to CRM data or functionality.

We are therefore closing this report as Informative.

In our experience, businesses tend to use Picklists as efficient shortcuts to ensure consistency, and will often include values such as key user names, hierarchcal roles, brands names, competitor names, product descriptors and parameters, locations etc.

Whilst there is no direct security impact (in Zoho's assessment), there could inadvertantly be Personally Identifible Information (PII) and at the very least acts as a blueprint of internal business logic.

Also, because a Client Script or Widget is Zoho-hosted, there could be the misconception that it is somehow more secure than an externally hosted Widget or Script - and therefore could be coded with exposed business logic and other sensitive parameters. 

Client Scripts and code associated with a Zoho-hosted widgets (HTML, CSS, Javascript) are not secured behind any authentication method.

Thoughts?

Does having your Data Model, Module Names, Field Names, Custom Picklist Values, Client Scripts and Widget code available via unauthenticated URLs concern you?

    Nederlandse Hulpbronnen


      • Recent Topics

      • Approval Process configuration is now more flexible and fully customizable

        The Approval Process is back with an improved user experience designed to make it easier to build structured, flexible, and intuitive approval workflows. Here’s a look at some of the key enhancements: Name Your Rules & Stages You can now give each approval
      • All new Address Field in Zoho CRM: maintain structured and accurate address inputs

        Availability Update: 29 September 2025: It's currently available for all new sign-ups and for existing Zoho CRM orgs which are in the Professional edition exclusively for IN DC users. 2 March 2026: Available to users in all DCs except US and EU DC. 24
      • 👍 Zoho CRM's Notes now gets Reactions and a new look

        Available in SA and JP DCs. Rolling out to other DCs in phases. Hello everyone, Notes help users capture important updates, collaborate with teammates, and maintain context for records. Now with Note Reactions, users can quickly acknowledge updates, express
      • Admin Logging in as another User

        How can a Super Admin login as another user. For example, I have a sales rep that is having issues with their Accounts and I want to view their Zoho Account with out having to do a GTM and sharing screens. Latest Update (27th April 2026): With the early
      • Introducing Approval SLA for Approval Processes

        Approvals can sometimes be delayed when approvers do not respond within the expected timeframe, which can slow down your recruitment processes. With the new Approval SLA in Zoho Recruit, you can set deadlines for approval requests and define automated
      • Introducing Microsoft Word Integration in Zoho Contracts

        We are excited to announce a new feature that brings contract authoring and negotiation in your familiar environment — the Microsoft Word Integration. What This Integration Brings The Microsoft Word Integration connects Zoho Contracts with the Microsoft
      • Map My Client Locations for Zoho CRM Extension: Turn CRM Addresses Into Action

        Hello everyone, Your CRM knows who your customers are. Now, see where they are on the interactive map directly from Zoho CRM. Introducing Map My Client Locations for Zoho CRM, an extension built for businesses that rely on sales visits, field service,
      • Scheduled and Automated Report Delivery from Zoho Projects

        Zoho Projects has useful reports including task reports, timesheet summaries, and workload charts. However, there is currently no way to schedule these reports to be automatically delivered to stakeholders on a recurring basis. This means: Project managers
      • How can I filter inactive/disable agent tickets?

        Hello, We have an user-agent that left the company and we inactive/disabled his agent. So, now I can no longer filter or search tickets that he is the current owner, or even create a rule to reassign tickets to another person when the ticket is reopen.
      • Add Reauthentication Option for Zoho Bug Tracker Integration in Zoho Desk

        Hello Zoho Desk Team, We hope you're doing well. We would like to request an enhancement to the Zoho Bug Tracker integration within Zoho Desk. Current Limitation: At the moment, there is no option to reauthenticate the Zoho Bug Tracker integration in
      • Dashboards for Customers

        Is it possible to build dashboards for each customers in the community for their tickets?
      • Collaborate Visually with Whiteboard in Zoho Projects

        Whiteboard in Zoho Projects allows you to collaborate visually by creating diagrams, annotating designs, and sketching project workflows using shapes, text, and images within project modules. Team members can work simultaneously, improving productivity
      • Fields in MS-Word Template

        With the new MS-Word integration, how does one create fields in an imported MS-Word document which can then automatically be populated with an Intake Form?
      • Displaying only unread tickets in ticket view

        Hello, I was wondering if someone might be able to help me with this one. We use filters to display our ticket list, typically using a saved filter which displays the tickets which are overdue or due today. What I'd really like is another filter that
      • Zoho Bookings Flow Step not Triggering on Appointment booked

        I noticed yesterday that my appointment booked flows were not triggering when we had booked appointments in Zoho Bookings. I checked the trigger and noticed the trigger values updated to be defined to a workspace and service event rather than our whole
      • UCP: Why We Killed the Multi-Portal Mess and Simplified Customer Self-Service

        Let's talk about the multi-portal mess nobody wants to admit that it exists. Your customer needs an invoice from one app, wants a ticket update from another, and has a project waiting in a third, each behind its own login, its own UI, its own "was it
      • Zoho Tables is now available in Zoho One!

        Hello Zoho One users, We’re excited to announce that Zoho Tables is now included as a part of Zoho One suite! As teams grow, managing projects, approvals, inventories, campaign trackers, and operational workflows across multiple spreadsheets become difficult.
      • Zoho Publish is now available in Zoho One!

        Hello Zoho One users, We’re excited to announce that Zoho Publish is now included as part of the Zoho One suite! As businesses grow, managing Google Business Profiles across many locations becomes challenging. Business information needs to stay accurate,
      • 📣 Ask the team behind Zoho SalesIQ: Summer '26 Q&A

        Hi everyone! Following our recent webinars, Summer '26 Release: What's New in Zoho SalesIQ—where we walked you through all the new features, what they do, and how they work—and Driving the AI Evolution: Building Smarter Customer Experiences with Zoho
      • Virtual Option for Fields

        Hi, I would like to be able to choose another option other than Read-Only or Disabled, such as Virtual. And with Virtual, the field is shown on the form and avilable in rules, but NOT saved to the Database. A use case is having multiple Large Lists of
      • Upcoming update to field values in Zoho Books - Zoho Analytics integration

        Hello Users, We'd like to inform you of an upcoming update to the tax_category values in the Zoho Books integration for Zoho Analytics from October 20, 2026. What's Changing? tax_category field values are being renamed to align with the conventions already
      • Prefix & Suffix on Single Line, Number, etc.

        Hi, I would like to have the same Prefix and Suffix that was added to the Unique ID on Text and Number Fields. Use case could be as basic as temperature, as per another Idea I have to use Single Line (Text) for a number that might have leading zeros today,
      • Announcing the new SKILL.md for Zoho CRM and the updated OAS repository!

        We are introducing a new zoho-crm skill to make working with Zoho CRM Developer tools (like APIs, functions, widgets, client scripts, queries etc) easier and faster, with the help of AI in your preferred AI harness like Claude Code, Codex, Cursor, VSCode
      • Handle Leading Zeros in a Number Field

        Hi, If I use a Number Field, set with Min 7 Digits and Max 7 Digits, and enter 0000001, it will result in 1 and an error as it removes the leading zeros, the same with entering 0012340 will result in 12340 and error. So I have to use a Text Field and
      • Kaizen #259 - Working with Zoho CRM APIs using zoho-crm skill

        In the previous Kaizen, we introduced the zoho-crm skill and discussed how it can work with different CRM developer capabilities. The zoho-crm skill makes it easier to work with Zoho CRM without having to remember every API endpoint, request structure,
      • How can I populate dropdown data with information from another source or app?

        I want to maintain a list of items in another app (say in excel or another database) and sync those as items in a drop down menu, instead of copy pasting to import. Is this kind of a feature available?
      • Zoho Community Digest - September 2026 | Part 1

        Hi everyone, and welcome back! September opens with a strong set of updates. Zoho CRM brings workflow automation down to the subform row level and ships a new SKILL.md for AI-assisted development, Zoho Desk introduces conditional branching with Automation
      • Tip #88 – Manage Incoming Support Requests Efficiently with the Service Queue – 'Insider Insights'

        Hello Zoho Assist Community! Not every team has a dedicated IT department or a fully built-out sysadmin setup. For smaller teams, when something breaks, there's no internal ticket system to log into, no helpdesk queue to route through, and no clear way
      • Delete CRM Portal

        How do I delete portals from my CRM? I created one just to test, it is not in use and is disabled but it's existence is preventing me from marking fields in modules as "required" unless I make it 'read/write' in the portal first. I'd rather just delete
      • Creating new Teams meeting from CRM doesn't enable Team functions in the meeting

        Hi I'm trying to set up the meeting integration and I've seen that when I create a Meeting in the CRM and set the location to Online and the Provider to Teams, and complete the boxes, add a participant etc, whilst the meeting is created in Teams, the
      • Zoho Books | Product updates | July 2026

        Hello users, We’re excited to bring you the latest updates in Zoho Books for July 2026! This month's release introduces Terminal Payments, CMP-08 filing for composition taxpayers, SEPA Credit Transfer support, and Self-Billed Credit Notes and Debit Notes
      • Calendar invites from Contacts not being assigned to Account in CRM

        Hi all It's that time of year again when I try to get calendar and meetings sorted in CRM. I have two way sync enabled. I have the option set to check for customer meeting invitation mail and to add them as meetings. However, whilst those meetings show
      • Kaizen #258 - Getting Started with zoho-crm SKILL.md

        Howdy tech wizards, Welcome to a fresh week of Kaizen. This week, we are taking a look at the zoho-crm SKILL.md, an Agent Skill designed to help AI coding agents work with Zoho CRM’s developer capabilities. What is zoho-crm SKILL.md? The zoho-crm skill
      • Zoho Tables is now live in Australia & New Zealand!

        Hey everyone! We’ve got some great news to share — Zoho Tables is now officially available in the Australian Data Center serving users across Australia and New Zealand regions! Yes, it took us a bit longer to get here, but this version of Zoho Tables
      • Dashboard/Component filter by probability

        Hi all Can I request the ability to add a Component or Dashboard filter for Deal Probability? Would be useful to be able to see data of deals more than 60% probable. Olly
      • Stock (on-hand) Items not updated after using Composite items

        Hi there, I created a Composite item (consist of 3 items). After I created the Composite item, I invoiced it and shipped the items. However the actual stock on hand of the 3items didn't change at all. Have you guys encountered this? Thank you Regards,
      • Is there a way to show contact emails in the Account?

        I know I can see the emails I have sent and received on a Contact detail view, but I want to be able to see all the emails that have been sent and received between all an Accounts Contacts on the Account Detail view. That way when I see the Account detail
      • Important changes for users with Zoho accounts in the UAE and other Data Centers

        What's changing? Previously, the same email address could be used to create separate Zoho accounts in both the UAE data center and another Zoho data center (such as US, EU, IN, AU, JP, CA, SA or SG). With this change, an email address can be associated
      • Conditional Layouts On Multi Select Field

        How we can use Conditional Layouts On Multi Select Field field? Please help. Moderation update: Multi-select picklist fields are now supported in Layout Rules. Additionally, Layout Rules is now available in the Professional Edition. These updates have
      • Zoho Marketing Automation WhatsApp Campaign Import Sync for Zoho Analytics

        WhatsApp is a critical channel in modern marketing, yet WhatsApp Campaign metrics from Zoho Marketing Automation currently cannot be natively imported into Zoho Analytics via the default advanced analytics connector. Integrating this into the standard
      • Next Page